Fix Gmail error 550 5.7.26: message does not pass authentication checks

You searched for that exact string because Gmail just bounced (or is about to bounce) your mail with it. Short version: Gmail requires bulk senders to pass SPF or DKIM in a way that’s aligned with DMARC. Right now, neither is. Here’s what that means and how to clear it.

What “SPF and DKIM both do not pass” actually means

DMARC alignment is stricter than a plain SPF or DKIM pass. It’s not enough for SPF to authorize the sending IP, or for DKIM to have a valid signature. The domain that check authenticates has to match (or be a subdomain of) the domain in your visible From: header.

• SPF alignment fails when the Return-Path/envelope-from domain doesn’t match your From: domain. That happens when a third-party sender (an ESP, a CRM, a support tool) sends on your behalf using its own envelope domain.
• DKIM alignment fails when the signature’s d= domain doesn’t match your From: domain. That happens when a sending tool signs with its own domain instead of yours.

Gmail’s error means both checks missed alignment on this message, so nothing backed up the claim that it really came from you.

The fix

1. Find every system that sends mail as your domain. Your primary mail server, plus anything else: marketing platform, helpdesk, billing/invoicing tool, CRM, forms.

2. Add each one to your SPF record, so the envelope-from domain resolves under your domain’s SPF:

   v=spf1 include:_spf.google.com include:sendgrid.net -all

3. Turn on DKIM signing for your domain in every one of those tools. Most third-party senders support “custom domain” or “branded” DKIM signing that signs with your domain instead of theirs. This is usually the bigger win: DKIM alignment survives forwarding, where SPF alignment does not.

4. Publish or check your DMARC record at _dmarc.yourdomain.com. Gmail is more forgiving when it has a record to weigh against, even at p=none:

   v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

5. Re-run the check below against your domain to confirm SPF, DKIM, and DMARC line up before you send the next campaign.

If only one sending source is affected, it’s almost always the one added most recently. Check that tool’s SPF include and DKIM signing settings first before touching anything else.

Confirm it’s fixed

Run the free DMARC checker below against your domain. It reads the live record, grades alignment, and tells you in plain English what’s still wrong if anything is.